CVE-2012-5627

Oracle Mysql < 5.5.29 - Insufficiently Protected Credentials

Title source: rule
STIX 2.1

Description

Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks.

Exploits (1)

exploitdb WORKING POC VERIFIED
by kingcope · perlremotelinux
https://www.exploit-db.com/exploits/38109

References (8)

Core 8
Core References
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2012/Dec/58
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=883719
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2012/Dec/83
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://seclists.org/oss-sec/2012/q4/424
Broken Link vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2013:102
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/53372
Patch, Third Party Advisory, VDB Entry vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201308-06.xml
Broken Link, Vendor Advisory x_refsource_confirm
https://mariadb.atlassian.net/browse/MDEV-3915

Scores

EPSS 0.0390
EPSS Percentile 88.3%

Details

CWE
CWE-522
Status published
Products (3)
mariadb/mariadb 10.0.0
mariadb/mariadb 5.2.0 - 5.2.14
oracle/mysql 5.5.0 - 5.5.29
Published Oct 01, 2013
Tracked Since Feb 18, 2026